Skip to content
compliancebase
GDPRChapter III — Right to Object

Article 21

Right to Object

GDPR · Regulation (EU) 2016/679 · Last verified August 2026

Objective

Enable individuals to object to certain public-interest, legitimate-interest, and direct-marketing processing, and stop processing when the applicable legal test requires it.

Points of focus

  • Offer clear objection channels, especially for direct marketing
  • Stop direct marketing and related profiling after objection
  • Assess compelling grounds for other challenged processing

Implementation notes

Represent objections as durable purpose-specific suppression signals, distribute them to campaign and audience tools, and retain the minimum suppression record needed to prevent re-enrollment. Operationalize offer clear objection channels, especially for direct marketing in ticketing, IdP, or GRC workflows with named owners — not only in a static policy PDF. Retain suppression-list configuration and marketing tests with reviewer identity, population scope, dates, and remediation outcomes auditors can sample. A recurring failure mode is that a user unsubscribes from email but remains in audience-sync advertising Revisit after material architecture, vendor, data-flow, or leadership changes and document the decision.

Audit tip: Sample suppression-list configuration and marketing tests with dates and named reviewers. Be ready to walk through how you detect and correct: a user unsubscribes from email but remains in audience-sync advertising

Evidence auditors typically request:

  • Suppression-list configuration and marketing tests
  • Objection case records and balancing decisions
  • Propagation evidence across advertising and CRM vendors

Common gaps

  • A user unsubscribes from email but remains in audience-sync advertising
  • Suppression data is deleted during account erasure and the person is later re-imported

Cross-Framework Mapping

FrameworkRequirementImplementation note
GDPRArticle 21This control
SOC 2CC3.2, CC6.1Trust Services Criteria evidence may support accountability, but does not establish GDPR lawfulness.
ISO 27001A.5.34, A.8.10ISO privacy and security controls can implement parts of this duty when mapped to processing.
HIPAA164.308(a)(1)HIPAA overlap depends on whether the same data is both ePHI and GDPR personal data.

Primary sources

Frequently Asked Questions

Right to Object applies to the systems and commitments in your GDPR scope. Translate the requirement into concrete operating workflows — offer clear objection channels, especially for direct marketing — with evidence stored where auditors and customers can sample it.

Lead with suppression-list configuration and marketing tests and pair it with objection case records and balancing decisions. Samples should show who performed the control, when, against which population, and what changed as a result.

Teams often fail because a user unsubscribes from email but remains in audience-sync advertising Close the loop with dated operating records and test the control on a realistic production path.

Control operation can often be shared across SOC 2, ISO 27001, GDPR, and HIPAA — but each framework uses different vocabulary and accountability. Maintain an explicit crosswalk rather than assuming equivalence.

Review at least annually and after material product, vendor, or data-flow changes. High-risk or privileged paths may need quarterly sampling even when the criterion does not prescribe a cadence.

Framework versions referenced in this page:

  • GDPR — Regulation (EU) 2016/679

Last verified: August 2026 · Primary sources linked above